Jay P. Anstine (jay.anstine@bannerhealth.com) is the Area Compliance Program Director for Banner Health’s Western Region Rural Hospitals.
As we enter 2021, it seems fitting to look back at 2020 related to Office for Civil Rights (OCR) enforcement activity to take note of any trends and make some educated predictions for 2021. To that end, I went back and took a look at 2020. As of the date of this writing (late 2020), below are three trends that caught my attention.
Big-dollar settlements/resolutions
There was definitely a continuing trend of big-dollar settlements/resolutions, picking up where 2019 left off. For purposes of this column, I define “big dollar” as anything more than $1 million. Below is a listing of the notable cases from 2020.[1]
|
Covered entity (CE)/Business associate (BA) |
Penalty amount | |
|---|---|---|
|
Premera Blue Cross (CE) |
$6.85 million | |
|
CHSPSC LLC (BA) |
$2.3 million | |
|
Athens Orthopedic Clinic PA (CE) |
$1.5 million | |
|
Lifespan Health System Affiliated Covered Entity (CE) |
$1.04 million | |
|
Aetna Life Insurance Company (CE) |
$1 million | |
Most of the above cases related to a lack of proper Security Rule safeguards, information made available over the internet, cyberattacks, and misdirecting protected health information.
Right of Access initiative
We saw a continuation of enforcement related to OCR’s Right of Access initiative, announced back in 2019. In 2020, we saw the number of settlements related to this initiative grow to 12, as of the date of this writing.[2]
COVID-19 guidance
With the emergence of the COVID-19 pandemic, OCR issued new guidance for navigating COVID-19. More specifically, it issued guidance related to telehealth communications, sharing information with first responders, community-based testing sites, public health oversight activities, and communications with former COVID-19 patients.
So what does this mean for 2021? I think we will continue to see large-dollar settlements with a continued focus on Security Rule safeguards. Additionally, I think activity related to the Right of Access initiative will continue; however, given it has been two years since this initiative was launched, I am wondering whether 2021 will bring the announcement of a new initiative. Finally, as we continue to fight COVID-19, we may see additional new guidance, and potentially new settlements/resolution agreements. For example, I feel with our increased use of telehealth and a remote workforce, these areas seem ripe for a potential breach that we have not encountered yet. What do you think will happen in 2021?